Revolut Faces a $3M Monero Ransom Threat

A hacker group calling itself "iamnotavillain" has issued a $3 million ransom demand against Revolut, threatening to sell stolen customer data to criminal networks if the British fintech does not comply within 24 hours.

The Ransom Demand

The amount demanded totals 6,000 Monero ($XMR) tokens, equivalent to approximately $3 million as of September 16, 2026. The group set its ultimatum via a digital countdown timer published on Wednesday, September 16, as revealed by a Financial Times investigation. The public nature of the demand is unusual, as hackers typically make ransom requests privately and only go public if a target refuses to pay or engage.

The digital asset was selected by the cybercriminals due to its privacy and anonymity cryptographic protocols. Monero's untraceable transaction design makes it a frequent choice in ransom cases, as law enforcement has limited ability to follow the payment trail.

Reuters reported that Revolut said it had received no ransom demand or direct contact from the attackers. The company also said its core systems and customer funds were unaffected.

How the Breach Happened and What Was Taken

The breach came after attackers posed as government officials and sent fraudulent requests for information that passed Revolut's checks, with the company handing over customer records before discovering the requests were fake. The group claims to have obtained records from approximately 680 customers after impersonating law enforcement officials.

Stolen records reportedly include identity documents, verification photos, and complete transaction histories. The attackers said blockchain analysis helped them identify customers with large crypto holdings. The selective targeting of high-value crypto accounts adds a layer of risk beyond the immediate ransom: Chainalysis has reported that violent "wrench attack" victims are often selected using information from data breaches, social media, or insiders, with more than $30 million estimated stolen in such attacks by mid-2026.

Revolut, with more than 80 million customers, sits at the intersection of banking, crypto, and increasingly valuable identity data. UK and European Union regulators have scheduled supervisory hearings on the incident toward the end of the third quarter of 2026.

Sources:
CoinDesk: Revolut hackers demand $3 million in Monero, threaten to sell customer data
Crypto.news: Revolut hackers demand $3M in Monero after data breach
Cryptopolitan: Revolut hackers demand $3 million as breach exposes crypto holders' data